Live data from Hacker News

Ask HN: We found a cracked version of our software on the web, now what?

news.ycombinator.com

161–170 of 297 posts

Re: Ask HN: We found a cracked version of our software on the web, now what?

#161

With newaudiotechnology.com we eventually switched to using USB sticks as dongles. The reason is that we noticed some paying users were cracking it, too, because our licensing system didn't allow dual boot or having a workstation and a laptop. But our licenses were supposed to be per user and people wanted to carry our software around with them. If setup correctly, the same USB stick is now used both as licensing don…

Have the licensed crackers started carrying the sticks around?

Re: Ask HN: We found a cracked version of our software on the web, now what?

#162

Earlier quoted context omitted.

Signing the software protects against tampering and attests that it came from who signed it. There are some systems that require signed applications before they allow them to run, but most systems dont. Signed drivers are more frequently required than applications. Cracking tampers with the binary, so the signature is removed.

The way I understand it is a signature is included in the binaries and when run the software will hash the binaries and the result is compared to the signature. If the two don't match the software has been tempered and the software won't run. If it is that easy to remove the signature then what is the point of signing a software? It will be like your first floor home has a steel door but the window is wide open.

I think this is the OS-level signature verification; so the OS (possibly with nudging) will still allow you to _run_ the binary, but won't say "this is from FooCorp" and may nag the user on startup "this is a potentially untrustworthy binary"

Re: Ask HN: We found a cracked version of our software on the web, now what?

#164
I have a similar problem and I don’t know how to deal with it either. Sometimes it’s hard enough to get actual customers to pay, if they felt that there was a viable free alternative many would take that option. I’ve had to shift focus from small companies to exclusively large companies which have very different needs. I now treat my offering to smaller companies as a loss leader. I no longer invest in new functionality for small companies and when the maintenance becomes too expensive we’ll abandon all work for small companies all together. Part of the shift up is moving from a desktop app to a browser app that few people would have access to the server software and given the complexity no big company is going to risk running pirate copies. Plus there is an immense legal risk to them if we find out. Having grown sufficiently large the loss of the smaller companies wouldn’t affect bottom line and would substantially reduce the number of companies interested in pirating. Some of our more advanced features we’ve kept secret and only available to big customers due to the risk of piracy with the small customers. It really does suck and I wish there was better protection available. It may get so bad we’ll have to do what ** ****** does and sue anyone who mentions them online.

Re: Ask HN: We found a cracked version of our software on the web, now what?

#165

Earlier quoted context omitted.

There was a videogame that got famous because it was pirated, it was a management game about setting up a gaming company. Turns out, the pirated copy had a special feature where the player would feel immense economic pressure from piracy, so a bunch of players asked how to win against this, it was pretty hard and really fun for people who knew what was going on. Point is, you could hide an Easter Egg for pirated vers…

That kind of thing is a cute idea but that specific example has always bothered me because it implies the devs really think that piracy is a catastrophe for sales.

[deleted]

Re: Ask HN: We found a cracked version of our software on the web, now what?

#166

Congratulations! Having cracked versions out there indicates that your software is both useful and notable, which is a point where many developers would love to arrive at, maybe, one day. As to what to do about it, there are two basic tracks, neither of which is incompatible with the other: 1. The legal route: notifying distribution sites that they're hosting content in violation of copyright law, requesting takedown…

>But above all, make sure not to confuse a "pirated copy" with a "lost sale". In 99% of cases, the Venn diagram of those has very little overlapping area. Very true. If they were never going to pay anyway, you haven't lost anything if they use a crack. It still irks though!

Consider it free training, education, and marketing rather than a lost sale.

It's literally the same reason most companies give students essentially fire sale discounts (often just free) versions of their software.

They're probably pirating it because they aren't deriving much if any revenue from using it yet (it's either for personal use, they're learning a new tool, or they have no money). But having that person familiar with your software and trained on it means that if they reach a spot where they're using it profitably for business - it's basically a guaranteed sale.

Re: Ask HN: We found a cracked version of our software on the web, now what?

#167

Congratulations! Having cracked versions out there indicates that your software is both useful and notable, which is a point where many developers would love to arrive at, maybe, one day. As to what to do about it, there are two basic tracks, neither of which is incompatible with the other: 1. The legal route: notifying distribution sites that they're hosting content in violation of copyright law, requesting takedown…

There was a videogame that got famous because it was pirated, it was a management game about setting up a gaming company. Turns out, the pirated copy had a special feature where the player would feel immense economic pressure from piracy, so a bunch of players asked how to win against this, it was pretty hard and really fun for people who knew what was going on. Point is, you could hide an Easter Egg for pirated vers…

> can you detect the lack of signatures?

I think a fundamental aspect of cracking consists of disabling such detection mechanisms. But if the cracker only digs far enough to ensure that it seems to work without nags, and not far enough to find Easter eggs, then it will probably work for a while until people catch on and demand a further crack.

It's really the OS that needs to detect a lack of expected signature, because the cracker isn't going to be able to disable an OS feature unless they release the cracked app as a while VM or something. But that's a thing...

Re: Ask HN: We found a cracked version of our software on the web, now what?

#168

Congratulations! Having cracked versions out there indicates that your software is both useful and notable, which is a point where many developers would love to arrive at, maybe, one day. As to what to do about it, there are two basic tracks, neither of which is incompatible with the other: 1. The legal route: notifying distribution sites that they're hosting content in violation of copyright law, requesting takedown…

There is a third option which I'm surprised no one has mentioned so far: Ignore them.

First, people or companies using the cracked version of your software were never going to buy it. These people do not pay for software, and nothing you do will convince them to pay for it.

Secondly, whatever measures you put in place to combat the cracked versions will potentially have a negative impact on your actual paying users - the real people you built the software for.

Extra security measures or hoops to jump through; extra validation or 'calls home.' - all extra things that can and will go wrong at some point for a real user.

Why would you inconvenience paying users to combat people who will never be paying users?

Ignore them, and spend your time improving your product for your real users.

[I've had 3 desktop apps cracked and hosted on Warez sites over the past 15 years - even appearing for sale on eBay on some occasions. I was worried the first time it happened, then I stopped caring. They made no difference.]

Re: Ask HN: We found a cracked version of our software on the web, now what?

#169
post #86

Earlier quoted context omitted.

I love this approach. If you can detect a crack and block it, it will get worked around. Injecting easter eggs is much more subtle. There was another game that made an otherwise easy jump between two platforms impossible, so the players who had cracked the game went on forums and unwittingly revealed themselves by asking how to complete that level.

We have implemented something similar. The most obvious way to crack our software will trigger certain bug. Whenever people report that bug I feel a little joy

> Whenever people report that bug I feel a little joy

I hope you are super duper 100% sure the bug can’t happen otherwise. I would hate to be your paying costumer and ignored because your drm system is buggy.

Re: Ask HN: We found a cracked version of our software on the web, now what?

#170

Congratulations! Having cracked versions out there indicates that your software is both useful and notable, which is a point where many developers would love to arrive at, maybe, one day. As to what to do about it, there are two basic tracks, neither of which is incompatible with the other: 1. The legal route: notifying distribution sites that they're hosting content in violation of copyright law, requesting takedown…

There was a videogame that got famous because it was pirated, it was a management game about setting up a gaming company. Turns out, the pirated copy had a special feature where the player would feel immense economic pressure from piracy, so a bunch of players asked how to win against this, it was pretty hard and really fun for people who knew what was going on. Point is, you could hide an Easter Egg for pirated vers…

Depending on the nature of the app a suitable easter egg may be that over time the outputs become randomly but subtly incorrect. Another technique is to canary mark outputs in some way (like a tell tale unique string in PDF/export outputs). In this way your sales team may be able to search for those outputs and put pressure on large orgs creating those files.
Post reply on HN